IP ASN¶
No Subscription Required
LimaCharlie provides access to this integration free of charge for all users, so no additional subscription is required.
With the ip-geo add-on subscribed, the ip-asn resource can be used as an API-based lookup to resolve IP addresses to their Autonomous System Number (ASN) and organization.
event: USER_LOGIN
op: lookup
resource: lcr://api/ip-asn
path: event/SOURCE_IP
metadata_rules:
op: is
value: 13335
path: autonomous_system_number
Step-by-step, this rule will do the following:
- Upon seeing a
USER_LOGINevent, retrieve theevent/SOURCE_IPvalue and look it up via theapi/ip-asnresource - Upon receiving a response from
api/ip-asn, evaluate it usingmetadata_rulesto see if the ASN matches 13335 (Cloudflare)
The format of the metadata returned looks like this:
The ASN data comes from the MaxMind GeoLite2-ASN database. For more information, visit maxmind.com.
See Also¶
- IP Geolocation — country, city, and location data
- Behavioral Detection — First-Seen with Lookup Metadata — using ASN in suppression keys